Standards & Methodology

Security 17 checks

Our security checks map to the OWASP Top 10 (2021) and the IETF / W3C transport- and content-security specifications. They cover HTTP-response hygiene observable from the public surface; they are not a substitute for penetration testing or a code-level audit.

• OWASP Top 10 (2021) — A02 (Cryptographic Failures), A04 (Insecure Design), A05 (Security Misconfiguration), A07 (Identification & Authentication Failures). owasp.org/Top10
• RFC 6797 — HTTP Strict Transport Security (HSTS). datatracker.ietf.org/doc/html/rfc6797
• RFC 7034 — HTTP Header Field X-Frame-Options. datatracker.ietf.org/doc/html/rfc7034
• RFC 6265 — HTTP State Management Mechanism (cookies, Secure / HttpOnly / SameSite). datatracker.ietf.org/doc/html/rfc6265
• RFC 9116 — A File Format to Aid in the Coordinated Disclosure of Vulnerabilities (security.txt). datatracker.ietf.org/doc/html/rfc9116
• W3C Content Security Policy Level 3. w3.org/TR/CSP3
• W3C Subresource Integrity. w3.org/TR/SRI
• W3C Referrer Policy. w3.org/TR/referrer-policy
• W3C Permissions Policy. w3.org/TR/permissions-policy

GDPR / Privacy 10 scored + 1 informational

Our GDPR checks reference the operative articles of the EU General Data Protection Regulation and the ePrivacy Directive, plus the EDPB's published guidance on consent — the consolidated standard for "what a compliant cookie banner actually looks like." We're transparent about what HTML alone can verify (presence of a consent platform) and what it cannot (runtime tag-blocking) — see gdpr.consent_layer_verified.

• Regulation (EU) 2016/679 (GDPR) — operative articles we cite: Art. 5(1)(e), Art. 7, Art. 13, Art. 14, Art. 28(3), Art. 32. eur-lex.europa.eu/eli/reg/2016/679/oj
• Directive 2002/58/EC (ePrivacy Directive), as transposed in Ireland by S.I. No. 336/2011. eur-lex.europa.eu/eli/dir/2002/58/oj
• EDPB Guidelines 03/2022 on Deceptive Design Patterns in Social Media Platform Interfaces and EDPB cookie-banner guidance (2023) — sets the "Reject must be as easy as Accept" baseline. edpb.europa.eu
• Irish ePrivacy Regulations 2011 (S.I. No. 336/2011) — domestic implementation of the ePrivacy Directive that applies to our buyers operating in Ireland.

NIS2 hygiene 12 checks

The NIS2 Directive (in force across the EU from October 2024) requires "essential" and "important" entities to take "appropriate and proportionate" technical, operational, and organisational measures. Article 21(2) enumerates ten measure categories; our checks map to the publicly-observable slices — transport security, header hygiene, vulnerability-disclosure contact, supply-chain (SRI), availability hints.

• Directive (EU) 2022/2555 (NIS2) — operative sub-paragraphs we cite: Art. 21(2)(a), (d), (f), (j). eur-lex.europa.eu/eli/dir/2022/2555/oj
• National Cyber Security Bill 2024 (Ireland's transposition of NIS2) — domestic-law layer for Irish buyers.
• RFC 9116 — security.txt format for the Art. 21(2)(j) vulnerability-handling obligation.

Technical SEO 29 checks

Our technical SEO checks reflect the documented, public guidance that Google Search Central + Bing Webmaster + the W3C / WHATWG publish — not speculation, not "Moz best practices," not paid SEO-tool heuristics. If a check fires here, you'll find a documented Google or W3C standard explaining why.

• Google Search Central documentation — canonical URLs, sitemap protocol, robots.txt handling, HTTPS as a ranking signal, structured-data guidance. developers.google.com/search/docs
• RFC 9309 — Robots Exclusion Protocol (the canonical robots.txt spec). datatracker.ietf.org/doc/html/rfc9309
• Sitemaps.org protocol — sitemap.xml format (Google / Yahoo / Microsoft joint specification, 2008). sitemaps.org
• schema.org vocabulary — structured-data types and properties. schema.org
• Open Graph Protocol — original spec (Facebook 2010) + de-facto cross-platform adoption (LinkedIn, X/Twitter Cards, Slack unfurls). ogp.me

AEO / GEO 33 checks (17 AEO + 16 GEO)

AI-search readiness (sometimes called AEO — Answer Engine Optimisation — or GEO — Generative Engine Optimisation) is the newest category here. It tests whether your site is structured in a way that AI assistants (ChatGPT search, Perplexity, Google AI Overviews, Bing Copilot) can confidently cite it. There is no single ratified standard yet; the checks combine emerging community conventions (llms.txt), long-standing structured-data specifications (Schema.org), and content-shape signals derived from how the major AI vendors publicly describe their citation logic. We're explicit on every check about whether it tests a formal spec or an emerging convention.

• llms.txt — community proposal for a machine-readable index of a site's documentation aimed at LLMs. We test for presence, structure, and discoverability. llmstxt.org
• schema.org JSON-LD vocabularies — FAQ, HowTo, Article, Speakable, Breadcrumb, Person, Organization. Citation-ready structured data; same vocabulary as the Technical SEO section but tested for AEO-specific patterns (direct-answer extractability, entity disambiguation). schema.org
• Published vendor guidance — Google Search Central's documentation on AI Overviews + structured data, Microsoft Bing Webmaster's guidance on Copilot citations, and OpenAI's documented crawler / ChatGPT-User docs.
• Content-shape heuristics — direct-answer paragraphs, definition blocks, content freshness, conversational phrasing, author entity, citable external authority. These are clearly labelled as heuristics, not standards.

WCAG accessibility 18 checks (WCAG 2.1 + 2.2 subset)

Web accessibility is now on the same compliance footing as security and privacy. The European Accessibility Act (Directive (EU) 2019/882) entered application on 28 June 2025 and obliges consumer-facing digital services to meet a WCAG-equivalent baseline; the harmonised European standard EN 301 549 v3.2.1 cites WCAG 2.1 Level AA directly, which is the binding legal floor. WCAG 2.2 (published October 2023) adds nine new Success Criteria on top — most need rendered- DOM testing, but three are meaningfully checkable from static HTML and we cover those: SC 3.2.6 Findable Help (A), SC 2.5.8 Target Size (AA), SC 3.3.8 Accessible Authentication (A). Every finding cites the SC number (e.g. "WCAG 1.1.1 A", "WCAG 2.5.8 AA — added in 2.2") so you can match it to a published recommendation rather than our interpretation of it.

Microenterprise exemption (EAA Art. 4(5)): businesses with fewer than 10 employees AND annual turnover (or balance sheet) under €2m that provide services are exempt from the EAA's accessibility obligations. If that's you, the WCAG audit is informational — useful for the wider audience it lets in, but not legally required.

• W3C WCAG 2.1 — Web Content Accessibility Guidelines, the canonical accessibility standard cited by EN 301 549 + the EAA. Our checks cover A and AA criteria verifiable from static HTML (image alt text, language declaration, heading hierarchy, form labels, ARIA landmarks, skip-nav, semantic structure, link/button semantics). w3.org/TR/WCAG21
• W3C WCAG 2.2 — published October 2023; adds nine new Success Criteria (focus visibility, dragging gestures, target size, accessible authentication, findable help, redundant entry). Most need a rendered DOM to test; we cover the three verifiable from static HTML (SC 3.2.6, 2.5.8, 3.3.8). Note: WCAG 2.2 also removes SC 4.1.1 Parsing — modern HTML parsers handle malformed markup, so that check no longer adds accessibility value. w3.org/TR/WCAG22
• W3C WAI-ARIA 1.2 — accessibility-tree contract for dynamic UI. We test for valid landmark roles and well-formed ARIA usage. w3.org/TR/wai-aria-1.2
• EN 301 549 v3.2.1 — the European harmonised accessibility standard for ICT products and services. References WCAG 2.1 Level AA verbatim for web content. etsi.org/deliver/etsi_en/301500_301599/301549
• Directive (EU) 2019/882 (European Accessibility Act) — in application from 28 June 2025; the binding instrument that makes WCAG conformance a legal requirement for consumer digital services across the EU. eur-lex.europa.eu/eli/dir/2019/882/oj
• Honest limitations — automated HTML-only tooling (anything that runs without rendering JS + interacting with the page) can cover roughly 30–40% of WCAG SCs. We are deliberately explicit on every check about whether we test statically (alt text, language, headings) or only inline-style signals (colour contrast on inline styles, focus indicators on :focus rules). Real-user-flow testing remains a manual step.